Wireless event correlation using anonymous data

ABSTRACT

In one embodiment, a method includes: transmitting a message to a first end point that includes an instruction to initiate a communication type, wherein the communication type includes sharing a randomization token between the first and second end points; obtaining a first communication report from the first end point and a second communication report from the second end point in response to initialization of a communication based on the communication type between the first end point and the second end point across the network, wherein the first and second communication reports respectively include a first and second hash that corresponds to a function of the randomization token and identity information; determining whether the first hash matches the second hash; generating a value that correlates the first and second end points with the communication across the network in response to determining that the first hash matches the second hash.

CROSS-REFERENCE TO RELATED APPLICATION

This application is a continuation of and claims the benefit of priorityto U.S. patent application Ser. No. 16/178,123, filed Nov. 1, 2018, andissued on Feb. 23, 2021 as U.S. Pat. No. 10,931,760, the entire contentsof which are incorporated herein by reference.

TECHNICAL FIELD

The present disclosure generally relates to wireless event correlationand, in particular, to systems, methods, and devices for concealingidentity information while retaining an ability to trace end pointidentity information from anonymized communication reports.

BACKGROUND

Public networks often make trade-offs when balancing privacy andtraceability. To this end, a network operator (e.g., a cloud federationor core network operator) supplies a network that links two end points(e.g., an access provider and an identity provider). The networkoperator may have a legal responsibility to respond to law enforcementinquires while also having a competing data privacy responsibility(e.g., General Data Privacy Regulation (GDPR)). Fulfilling both of theseresponsibilities at the same time is a problem for the network operator.

BRIEF DESCRIPTION OF THE DRAWINGS

So that the present disclosure can be understood by those of ordinaryskill in the art, a more detailed description may be had by reference toaspects of some illustrative embodiments, some of which are shown in theaccompanying drawings.

FIG. 1 is block diagram of an example network environment in accordancewith some embodiments.

FIG. 2A is a process flow diagram that illustrates an approach forgenerating communication reports using coordinated randomization tokensin accordance with some embodiments.

FIG. 2B is a process flow diagram that illustrates an approach forgenerating communication reports using uncoordinated randomizationtokens in accordance with some embodiments.

FIG. 3 is a process flow diagram that illustrates an approach fortracing end point identity information from anonymized communicationreports in accordance with some embodiments.

FIG. 4 is a flow representation of a method of tracing end pointidentity information from anonymized communication reports in accordancewith some embodiments.

FIG. 5 is a flow representation of a method of generating anonymizedcommunication reports using a shared randomization token in accordancewith some embodiments.

FIG. 6 is a schematic block diagram of an example network controller inaccordance with some embodiments.

In accordance with common practice, the various features illustrated inthe drawings may not be drawn to scale. Accordingly, the dimensions ofthe various features may be arbitrarily expanded or reduced for clarity.In addition, some of the drawings may not depict all of the componentsof a given system, method or device. Finally, like reference numeralsmay be used to denote like features throughout the specification andfigures.

DESCRIPTION OF EXAMPLE EMBODIMENTS

Numerous details are described in order to provide a thoroughunderstanding of the illustrative embodiments shown in the accompanyingdrawings. However, the accompanying drawings merely show some exampleaspects of the present disclosure and are therefore not to be consideredlimiting. Those of ordinary skill in the art will appreciate from thepresent disclosure that other effective aspects and/or variants do notinclude all of the specific details of the example embodiments describedherein. While pertinent features are shown and described, those ofordinary skill in the art will appreciate from the present disclosurethat various other features, including well-known systems, methods,components, devices and circuits have not been illustrated or describedin exhaustive detail for the sake of brevity and so as not to obscuremore pertinent aspects of the example embodiments described herein.

Overview

Various embodiments disclosed herein include methods, devices, andsystems for concealing identity information while having an ability totrace end point identity information from anonymized communicationreports. For example, in various embodiments, a method is performed by anetwork controller, including one or more processors and non-transitorymemory, that manages network connectivity between a first end point anda second end point. In various embodiments, the method includestransmitting a message to the first end point that includes aninstruction to initiate a communication type when the first end pointcommunicates with the second end point across a network, wherein thecommunication type includes sharing a randomization token between thefirst end point and the second end point. The method includes obtaininga first communication report from the first end point in response toinitialization of a communication based on the communication typebetween the first end point and the second end point across the network,wherein the first communication report includes a first hash thatcorresponds to a function of the randomization token and identityinformation. The method further includes obtaining a secondcommunication report from the second end point in response to theinitialization of the communication based on the communication typebetween the first end point and the second end point across the network,wherein the second communication report includes a second hash thatcorresponds to the function of the randomization token and the identityinformation. The method further includes determining whether the firsthash matches the second hash. The method further includes generating avalue that correlates the first end point and second end point with thecommunication across the network in response to determining that thefirst hash matches the second hash. In accordance with some embodiments,the network controller includes one or more processors and anon-transitory memory.

In accordance with some embodiments, a device includes one or moreprocessors, a non-transitory memory, and one or more programs; the oneor more programs are stored in the non-transitory memory, which, whenexecuted by the one or more processors, cause the device to perform orcause performance of any of the methods described herein. In accordancewith some embodiments, a non-transitory memory has stored thereininstructions, which, when executed by one or more processors of adevice, cause the device to perform or cause performance of any of themethods described herein. In accordance with some embodiments, a deviceincludes: one or more processors, a non-transitory memory, and means forperforming or causing performance of any of the methods describedherein.

EXAMPLE EMBODIMENTS

Some embodiments allow a network operator to remain neutral and stillretain the ability to correlate anonymous communication reports that areindependently generated by two end points. Each of the two end pointsgenerate an anonymous respective communication report using a sharedrandomization token and then generate a hash value that is a function ofthe shared randomization token and end point identity information. As aresult, the network operator can trace end point identity information bycomparing hash values from the anonymized communication reports.

FIG. 1 illustrates an example network architecture 100 in accordancewith some embodiments. While pertinent features are shown, those ofordinary skill in the art will appreciate from the present disclosurethat various other features have not been illustrated for the sake ofbrevity and so as not to obscure more pertinent aspects of the exampleembodiments disclosed herein. To that end, the example networkarchitecture includes an access network 103 that includes at least afirst user device 102, a second user device 104, and a first end point106 (e.g., a gateway node), a cloud federation 105 that includes atleast two border gateways (e.g., a border gateway 108 a and a bordergateway 108 b) and a core routing network 113, a network controller 110,and an identity provider network 107 that includes at least a second endpoint 112 (e.g., a gateway node).

In some embodiments, the access network 103 corresponds to an accessprovider (e.g., a public Wi-Fi hotspot or the like) that provides accessto the Internet or some other network to the first user device 102 andthe second user device 104. The access provider has visibility into theMedia Access Control (MAC) address and Internet protocol (IP) addressactivity associated with the first user device 102 and the second userdevice 104. In some embodiments, for privacy reasons, the access network103 tracks user device identities (e.g., MAC or IP addresses) at thescale of individual sessions but does not track user device identitiesfrom one session to the next.

The first user device 102 or the second user device 104 may be anysuitable type of device, such as a cellular telephone, a smart phone, atablet device, a laptop device, an Internet of Things (IoT) device, orthe like.

In some embodiments, the identity provider network 107 corresponds to anidentity authentication or single-sign on (SSO) provider (e.g., a socialmedia platform, an SSO platform, or the like) that, for example,authenticates the users of the first user device 102 or the second userdevice 104 based on existing login credentials prior to gaining accessto the access network 103.

The first end point 106 (e.g., a gateway node associated with the accessnetwork 103) and the second end point 112 (e.g., a gateway nodeassociated with the identity provider network 107) are each provided asa single entity (e.g., a server, a virtual machine, etc.) In someembodiments, the first end point 106 and the second end point 112correspond to gateway devices, routers, managed switches, unmanagedswitches, hubs, bridges, access points, or a suitable combinationthereof. In some embodiments, the first end point 106 and the second endpoint 112 are implemented as a distributed system including a suitablecombination of software, data structures, virtual machines, computingdevices, servers, switches, and routers. For the sake of brevity andconvenience, the first end point 106 and the second end point 112 areeach described herein as a single entity.

As shown in FIG. 1, the first end point 106 associated with the accessnetwork 103 is connected to the border gateway 108 a associated with thecloud federation 105. Similarly, the second end point 112 associatedwith the identity provider network 107 is connected to the bordergateway 108 b associated with the cloud federation 105. A person ofordinary skill in the art would appreciate that although FIG. 1 shows afirst end point 106 associated with access network 103 and the secondend point 112 associated with the identity provider network 107, the endpoints can be situated within other types of networks. Accordingly, thecloud federation can also be replaced with other intermediary networksand/or backbones in various other embodiments.

As shown in FIG. 1, the cloud federation 105 includes the border gateway108 a, the border gateway 108 b, and a core routing network 113 (e.g., aplurality of routers, switches, hubs, and/or the like). In accordancewith some embodiments, a network controller 110 is connected to thecloud federation 105. In some embodiments, the cloud federation 105corresponds to a neutral cloud federation that acts as an intermediarybetween the first end point 106 and the second end point 112. The cloudfederation 105 acts as a link between the first end point 106 and thesecond end point 112, but should not be involved in user deviceidentification or tracking. Otherwise, the cloud federation 105 maybecome caught in a liability chain and may start having to keep track ofa multiplicity of identifiers for users, locations, and the like. Inaddition, the cloud federation 105 may need to comply with General DataProtection Regulation (GDPR) requirements. The GDPR corresponds to a seta legal structure applicable in multiple areas (e.g., most Europeancountries) that makes an important distinction around handlingpseudonymous versus anonymous identifies. In this context, the cloudfederation 105 may become potentially liable, as the cloud federation105 may know or be able to derive unique identifiers for each user.

FIG. 1 also illustrates an encrypted tunnel 114 as being a conceptuallyseparate communication channel connecting the first user device 102 tothe second end point 112. In some embodiments, the encrypted tunnel 114utilizes portions of the access network 103, the cloud federation 105,and the identity provider network 107.

FIG. 2A depicts a process flow 200 a implemented by a system forgenerating communication reports using coordinated randomization tokensin accordance with some embodiments. As an option, one or more instancesof the process flow 200 a or any aspect thereof may be implemented inthe context of the architecture and functionality of the embodimentsdescribed herein. Also, the process flow 200 a or any aspect thereof maybe implemented in any desired environment. In some embodiments, a userdevice 201, a first end point 106, a network operator 205, and a secondend point 112 exhibit a set of high-level interactions (e.g.,operations, messages, etc.) as shown in the process flow 200 a in FIG.2.

In some embodiments, as represented by operation 202, the networkoperator 205 generates a randomization token. In some embodiments, thenetwork operator 205 corresponds to a cloud federation or a networkcontroller (e.g., the network controller 110 shown in FIG. 1) therefor.In some embodiments, the randomization token corresponds to a securitytoken. In some embodiments, the randomization token corresponds to arandomization value that is colloquially referred to as a “salt” value.In some embodiments, the salt value is a random or pseudo-random valuethat is used as an additional input to a one-way function (e.g., acryptographic hash function such as MD5, SHA-1, SHA-2, SHA-3, or thelike) that hashes data, a password, or passphrases. As such, salt valuesare used to safeguard passwords in storage because a new salt value israndomly generated for each password. For example, the salt value andthe password are concatenated and processed with a cryptographic hashfunction, and the resulting output (but not the password) is stored withthe salt in a database.

In some embodiments, as represented by operation 204, the networkoperator 205 sends the randomization token to the first end point 106.In some embodiments, the first end point 106 corresponds to an accessprovider such as a retailer that provides a Wi-Fi hotspot.

In some embodiments, as represented by operation 206, the networkoperator 205 sends the randomization token to the second end point 112.In some embodiments, the second end point 112 corresponds to an identityprovider such as a social media platform, an SSO platform, or the like.

In some embodiments, as represented by operation 208, the user device201 authenticates a user identity with the second end point 112. Forexample, a user may use the user device 201 to log into his/her socialmedia account using pre-existing login credentials, and the user is, inturn, authenticated by the social media platform (e.g., associated withthe second end point 112).

In some embodiments, as represented by operation 210, the first endpoint 106 generates a first communication report using the randomizationtoken and sends the first communication report to the network operator205. In some embodiments, the first communication report includes afirst hash that corresponds to a function of the randomization token andidentity information.

In some embodiments, as represented by operation 212, the second endpoint 112 generates a second communication report using the samerandomization token as the first end point 106 and sends the secondcommunication report to the network operator 205. In some embodiments,the second communication report includes a second hash that correspondsto a function of the randomization token and identity information.

In some embodiments, as represented by operation 214, the networkoperator 205 attempts to correlate the first and second communicationreports by comparing the hashes therein. The network operator 205 isable to correlate the first and second communication reports because thefirst and second hashes match due to the usage of the same randomizationtoken provided by the network operator 205 to the first end point 106and the second end point 112. However, the network operator 205 is ableto derive the identity information because the network operator 205generated the randomization token and provided the randomization tokento the first end point 106 and the second end point 112. In other words,the same randomization token establishes a commonality between what thefirst end point 106 transmits and what the second end point 112transmits. As such, the network operator 205 can reverse engineer anyencrypted data (e.g., the first and second communication reports) thatis sent by the first end point 106 or the second end point 112 thatinvolves the randomization token. As a result, the network operator 205cannot remain neutral in the process flow 200 a because the networkoperator 205 has the ability to derive the identity information. Even ifthe network operator 205 does not reverse engineer any encrypted data,the network operator 205 is still liable for personally identifiableinformation (PII) because the network operator 205 can keep therandomization token static such that that the hashed value for the sameidentity information will be identical.

FIG. 2B depicts a process flow 200 b implemented by a system forgenerating communication reports using uncoordinated randomizationtokens in accordance with some embodiments. As an option, one or moreinstances of the process flow 200 b or any aspect thereof may beimplemented in the context of the architecture and functionality of theembodiments described herein. Also, the process flow 200 b or any aspectthereof may be implemented in any desired environment. In someembodiments, a user device 201, a first end point 106, a networkoperator 205, and a second end point 112 exhibit a set of high-levelinteractions (e.g., operations, messages, etc.) as shown in the processflow 200 b in FIG. 2.

In contrast to the process flow 200 a, the process flow 200 b describesa method where the first end point 106 and the second end point 112independently generate randomization tokens instead of the networkoperator 205 generating the randomization token. This allows the networkoperator 205 to stay “neutral” because the network operator 205 isunable to derive identity information within communication reportsgenerated by using the randomization token.

In some embodiments, as represented by operation 216, the first endpoint 106 generates a first randomization token.

In some embodiments, as represented by operation 218, the second endpoint 112 generates a second randomization token. The secondrandomization token is different from the first randomization tokenbecause the second randomization token is generated by the second endpoint 112 rather than by the first end point 106.

In some embodiments, as represented by operation 220, the user device201 authenticates a user identity with the second end point 112. Forexample, as described above with respect to the operation 208 in FIG.2A, a user may use the user device 201 to log into his/her social mediaaccount using pre-existing login credentials, and the user is, in turn,authenticated by the social media platform (e.g., associated with thesecond end point 112).

In some embodiments, as represented by operation 222, the first endpoint 106 generates a first communication report using the firstrandomization token and sends the first communication report to thenetwork operator 205. In some embodiments, the first communicationreport includes a first hash that corresponds to a function of the firstrandomization token and identity information.

In some embodiments, as represented by operation 224, the second endpoint generates a second communication report using the secondrandomization token and sends the second communication report to thenetwork operator 205. In some embodiments, the second communicationreport includes a second hash that corresponds to a function of thesecond randomization token and identity information.

In some embodiments, as represented by operation 226, the networkoperator 205 attempts to correlate the first communication report andthe second communication report by comparing the hashes therein.However, the network operator 205 cannot correlate the first and secondcommunication reports because the hashes will not match due to the usageof the first and second randomization tokens, which include differentvalues. Furthermore, the network operator 205 cannot correlate the firstand second communication reports because the network operator 205 has noknowledge of the values associated with the first and secondrandomization tokens. As a result, unlike the operation 214 shown inFIG. 2A, there is no commonality between the first end point 106 and thesecond end point 112.

FIG. 3 depicts a process flow 300 implemented by a system for tracingend point identity information from anonymized communication reports inaccordance with some embodiments. As an option, one or more instances ofthe process flow 300 or any aspect thereof may be implemented in thecontext of the architecture and functionality of the embodimentsdescribed herein. Also, the process flow 300 or any aspect thereof maybe implemented in any desired environment. In some embodiments, a userdevice 201, a first end point 106, a network operator 205, and a secondend point 112 exhibit a set of high-level interactions (e.g.,operations, messages, etc.) as shown in the process flow 300 in FIG. 3.

In contrast to the process flow 200 a from FIG. 2A and the process flow200 b from FIG. 2B, the process flow 300 describes a method forconcealing identity information from the network operator 205 whilehaving an ability to trace an identity of the first end point 106 and anidentity of the second end point 112 from anonymized communicationreports that are independently generated using a shared randomizationtoken.

In some embodiments, as represented by operation 302, the networkoperator 205 sends a message initiating a communication type to thefirst end point 106. In some embodiments, the communication typecorresponds to a distributed reporting scheme that supports anonymousdata (from the perspective of the network operator 205). In someembodiments, the network operator 205 configures the rate at which endpoints may refresh or generate randomization tokens in order to maintaintemporal continuity.

In some embodiments, as represented by operation 304, the first endpoint 106 generates a randomization token.

In some embodiments, as represented by operation 306, the user device201 performs user authentication using the communication type in orderto both authenticate a user identity with the second end point 112 andalso signal the randomization token to the second end point 112. Here,the first end point 106 signals the randomization token to the secondend point 112 using an encrypted tunnel (e.g., the encrypted tunnel 114shown in FIG. 1). As a result, the first end point 106 and the secondend point 112 possess the same randomization token, but the networkoperator 205 does not possess the randomization token or any knowledgeabout the randomization token.

In some embodiments, as represented by operation 308, the first endpoint 106 generates a first communication report using the randomizationtoken and sends the first communication report to the network operator205. In some embodiments, the first communication report includes afirst hash that corresponds to a function of the randomization token andidentity information.

In some embodiments, as represented by operation 310, the second endpoint 112 generates a second communication report using therandomization token shared from the first end point 106 and sends thesecond communication report to the network operator 205. In someembodiments, the second communication report includes a second hash thatcorresponds to a function of the randomization token and identityinformation.

In some embodiments, as represented by operation 312, the networkoperator 205 attempts to correlate the first and second communicationreports by comparing the hashes therein. The network operator 205 isable to correlate the first and second communication reports because thefirst and second hashes match due to the usage of the same randomizationtoken shared between the first end point 106 and the second end point112.

As mentioned in operation 308 and 310, the first end point 106 and thesecond end point 112 both used the same randomization token to generatetheir respective communication reports. As such, even though thecommunication reports were generated independently and containanonymized data (from the perspective of the network operator 205), thenetwork operator 205 has the ability to correlate the first end point106 and the second end point 112 with a communication across the networkby comparing hash values from the communication reports. As a result,the network operator stays “neutral” because the network operator 205has no knowledge of the randomization token. An advantage of the networkoperator 205 being neutral is to obviate the need for the networkoperator 205 to comply with GDPR requirements.

In some embodiments, as represented by operation 314, the first endpoint 106 refreshes the randomization token for each new session. Insome embodiments, the network operator 205 places restrictions on howoften an end point can generate a randomization token in order torestrict repeated access attempts from a common identity (e.g., MACaddress) to be identified by the network operator 205.

FIG. 4 is a flowchart representation of a method 400 of tracing endpoint identity information from anonymized communication reports thatare independently generated using a shared anonymization token inaccordance with some embodiments. In some embodiments, the method 400 isperformed by a network controller (e.g., the network controller 110shown in FIG. 1) managing network connectivity between a first end point(e.g., the first end point 106 shown in FIG. 1) and a second end point(e.g., the second end point 112 shown in FIG. 1). In some embodiments,the method 400 is performed by processing logic, including hardware,firmware, software, or a combination thereof. In some embodiments, themethod 400 is performed by a processor executing code stored innon-transitory computer-readable medium (e.g., a memory). In someembodiments, a set of computer readable instructions that are executedat a device including the node implements the method 400.

In some embodiments, the first end point corresponds to an accessprovider (e.g., a retailer with a Wi-Fi hotspot), and the second endpoint corresponds to an identity provider (e.g., a social mediaplatform, an SSO platform, or the like). For example, the networkcontroller corresponds to a management and control function of a neutralcloud federation (e.g., the cloud federation 105 in FIG. 1) that acts asan intermediary between the first end point and the second end point. Insome embodiments, the neutral cloud federation acts as a link betweenthe first end point and the second end point but should not be involvedin user equipment identification or tracking.

To that end, as represented by block 410, the method 400 includestransmitting a message to the first end point that includes aninstruction to initiate a communication type when the first end pointcommunicates with the second end point across a network associated withthe network controller, wherein the communication type includes sharinga randomization token between the first end point and the second endpoint. In some embodiments, the communication type corresponds to a saltgeneration policy. In some embodiments, the randomization tokencorresponds to random “salt” value that acts to anonymize future hashvalues in communication reports. The randomization token is never sharedwith the network in order to maintain its neutrality. In someembodiments, the first end point communicates with the second end pointin order to initialize a communication session via an encrypted tunnel(e.g., the encrypted tunnel 114 shown in FIG. 1). For example, thecommunication session includes authenticating a user device attemptingto connect to the second end point (e.g., an identity provider).

In some embodiments, the network operator defines a new attribute withinthe encrypted tunnel that will contain the randomization token. In someembodiments, the network operator may place restrictions on how oftenthe randomization token is refreshed in order to enable repeated accessattempts from a common identity to be identified by the network. In someembodiments, the network operator defines an authentication,authorization, and accounting, (AAA) attribute within an extensibleauthentication protocol (EAP) exchange for signaling random salt foranonymized reporting. For example, the AAA attribute may correspond toan available header or empty slot within packet(s) transported throughthe encrypted tunnel. As such, the randomization token is included in adata packet sent through the encrypted tunnel as an AAA attribute thatis sent to the second end point. In some embodiments, the networkoperator uses a combination of dynamic domain name system (DNS) roamingsuch that the network operator is not involved in proxying the AAAattribute.

To that end, as represented by block 420, the method 400 includesobtaining a first communication report from the first end point inresponse to initialization of a communication based on the communicationtype between the first end point and second end point across the networkassociated with the network controller, wherein the first communicationreport includes a first hash that corresponds to a function of therandomization token and identity information. In some embodiments, thefirst and second communication reports correspond to federated tickersystem (F-TICKs) identity logs that include a hash value that is afunction of the randomization token (e.g., a shared salt value) andidentity information (e.g., MAC address or IP address of the userdevice, location of the access provider or the user device, or thelike). The F-TICKs identity log is a syslog-like report corresponding tofeedback after a message is sent.

To that end, as represented by block 430, the method includes obtaininga second communication report from the second end point in response tothe initialization of the communication based on the communication typebetween the first end point and second end point across the networkassociated with the network controller, wherein the second communicationreport includes a second hash that corresponds to the function of therandomization token and the identity information

From the perspective of the network operator, the first and secondcommunication reports include anonymous data, which enables the networkoperator to comply with the GDPR. Furthermore, the network operator isunable to access data associated with the encrypted tunnel. As such, thenetwork operator is unable to derive the identity information from thehash values within the communication reports because the networkoperator has no knowledge of the value associated with the randomizationtoken.

To that end, as represented by block 440, the method includesdetermining whether the first hash matches the second hash.

To that end, as represented by block 450, the method includes generatinga value that correlates the first end point and second end point withthe communication across the network in response to determining that thefirst hash matches the second hash. The network operator does not haveany knowledge of the randomization token. As a result of thecommunication type, user anonymity is maintained because, withoutknowledge of the randomization token, the network operator cannotreverse engineer the hash where the hash is a function of identityinformation associated with the user and the randomization token.However, the network operator is also able to keep a record ofcommunication sessions between end points across its network whilemaintaining anonymity for associated users.

In some embodiments, the network operator maintains a sessioncorrelation matrix containing entries that correlate a first end pointand a second end point with a communication session across a network.For example, each entry also includes a timestamp and other informationsuch as bandwidth consumed and/or the like.

FIG. 5 is a flowchart representation of a method 500 of generatinganonymized communication reports using a shared randomization token inaccordance with some embodiments. In some embodiments, the method 500 isperformed by a first end point (e.g., the first end point 106 shown inFIG. 1) or a second end point (e.g., the second end point 112 shown inFIG. 1). In some embodiments, the method 500 is performed by processinglogic, including hardware, firmware, software, or a combination thereof.In some embodiments, the method 500 is performed by a processorexecuting code stored in non-transitory computer-readable medium (e.g.,a memory). In some embodiments, a set of computer readable instructionsthat are executed at a device including the node implements the method500.

To that end, as represented by block 510, the method 500 includesobtaining a message, from a network controller, that includes aninstruction to initiate a communication type when communicating with thesecond end point across a network associated with the networkcontroller.

To that end, as represented by block 520, the method 500 includesgenerating a randomization token. In some embodiments, the randomizationtoken is generated according to a specific technique such as aparticular random or pseudo-random number generator or a numbergenerator based on specified seed data such as cosmic noise, radiationdecay, thermal noise, shot noise, or the like.

To that end, as represented by block 530, the method 500 includesgenerating a first communication report using the randomization token.In some embodiments, the first communication report includes onlyminimal information needed in order to generate statistics. In someembodiments, the first communication report is sent with sysloginformation to the network controller. In some embodiments, a mastercommunication report includes a plurality of communication reports fordifferent communication sessions.

FIG. 6 is a block diagram of a network controller 110 enabled with oneor more components of a device in accordance with some embodiments.While certain specific features are illustrated, those of ordinary skillin the art will appreciate from the present disclosure that variousother features have not been illustrated for the sake of brevity, and soas not to obscure more pertinent aspects of the embodiments disclosedherein. To that end, as a non-limiting example, in some embodiments thenetwork controller 110 includes one or more processing units 601 (e.g.,one or more central processing units (CPUs), graphics processing units(GPUs), application specific integrated circuits (ASICs),field-programmable gate arrays (FPGAs), processing cores, or the like),a network interface 602, a programming interface 603, a memory 604, andone or more communication buses 605 for interconnecting these andvarious other components.

In some embodiments, the one or more communication buses 605 includecircuitry that interconnects and controls communications between systemcomponents. The memory 604 includes high-speed random-access memory,such as DRAM, SRAM, DDR, RAM, or other random-access solid-state memorydevices, and may include non-volatile memory, such as one or moremagnetic disk storage devices, optical disk storage devices, flashmemory devices, or other non-volatile solid-state storage devices. Thememory 604 optionally includes one or more storage devices remotelylocated from the one or more processing units 601. The memory 604comprises a non-transitory computer readable storage medium.

In some embodiments, the memory 604 or the non-transitory computerreadable storage medium of the memory 604 stores the following programs,modules, and data structures, or a subset thereof including an optionaloperating system 606, a correlation module 612, an instruction module614, and a policy module 616. The operating system 606 includesprocedures for handling various basic system services and for performinghardware dependent tasks.

In some embodiments, the correlation module 612 is configured todetermine whether a first hash value matches a second hash value. Insome embodiments, the correlation module 612 also generates a value thatcorrelates the first end point 106 and the second end point 112 with acommunication across a network. To that end, in various embodiments, thecorrelation module 612 includes a set of instructions and/or logic 612a, and heuristics and metadata 612 b.

In some embodiments, the instruction module 614 is configured to sendinstructions for initiating a security scheme associated with acommunication type when a first end point communicates with a second endpoint across the network associated with the network controller 110. Tothat end, in various embodiments, the instruction module 614 includes aset of instructions and/or logic 614 a, and heuristics and metadata 614b.

In some embodiments, the policy module 616 is configured to configurethe communication type in order to place restrictions on how often arandomization token is refreshed and store configuration information forthe communication type. To that end, in various embodiments, the policymodule 616 includes a set of instructions and/or logic 616 a, andheuristics and metadata 616 b.

Although the correlation module 612, the instruction module 614, and thepolicy module 616 are illustrated as residing on a network controller110, it should be understood that in other embodiments, any combinationof the correlation module 612, the instruction module 614, and thepolicy module 616 may reside on a separate computing device.

Moreover, FIG. 6 is intended more as functional description of thevarious features which may be present in a particular embodiment asopposed to a structural schematic of the embodiments described herein.As recognized by those of ordinary skill in the art, items shownseparately could be combined and some items could be separated. Forexample, some functional modules shown separately in FIG. 6 could beimplemented in a single module and the various functions of singlefunctional blocks could be implemented by one or more functional blocksin various embodiments. The actual number of modules and the division ofparticular functions and how features are allocated among them will varyfrom one embodiment to another and, in some embodiments, may depend inpart on the particular combination of hardware, software, and/orfirmware chosen for a particular embodiment.

Various aspects of embodiments within the scope of the appended claimsare described above. It should be apparent that the various features ofembodiments described above may be embodied in a wide variety of formsand that any specific structure and/or function described above ismerely illustrative. Based on the present disclosure, one skilled in theart should appreciate that an aspect described herein may be implementedindependently of any other aspects and that two or more of these aspectsmay be combined in various ways. For example, an apparatus may beimplemented and/or a method may be practiced using any number of theaspects set forth herein. In addition, such an apparatus may beimplemented and/or such a method may be practiced using other structureand/or functionality in addition to or other than one or more of theaspects set forth herein.

It will also be understood that, although the terms “first”, “second”,etc. may be used herein to describe various elements, these elementsshould not be limited by these terms. These terms are only used todistinguish one element from another. For example, a first communicationreport could be termed a second communication report, and, similarly, asecond communication report could be termed a first communicationreport, without changing the meaning of the description, so long as alloccurrences of the “first communication report” are renamed consistentlyand all occurrences of the “second communication report” are renamedconsistently. The first communication report and the secondcommunication report are both communication report, but they are not thesame communication report.

The terminology used herein is for the purpose of describing particularembodiments only and is not intended to be limiting of the claims. Asused in the description of the embodiments and the appended claims, thesingular forms “a”, “an”, and “the” are intended to include the pluralforms as well, unless the context clearly indicates otherwise. It willalso be understood that the term “and/or” as used herein refers to andencompasses any and all possible combinations of one or more of theassociated listed items. It will be further understood that the terms“comprises” and/or “comprising”, when used in this specification,specify the presence of stated features, integers, steps, operations,elements, and/or components, but do not preclude the presence oraddition of one or more other features, integers, steps, operations,elements, components, and/or groups thereof.

As used herein, the term “if” may be construed to mean “when” or “upon”or “in response to determining” or “in accordance with a determination”or “in response to detecting,” that a stated condition precedent istrue, depending on the context. Similarly, the phrase “if it isdetermined [that a stated condition precedent is true]” or “if [a statedcondition precedent is true]” or “when [a stated condition precedent istrue]” may be construed to mean “upon determining” or “in response todetermining” or “in accordance with a determination” or “upon detecting”or “in response to detecting” that the stated condition precedent istrue, depending on the context.

What is claimed is:
 1. A method comprising: obtaining, by a controller,a first communication report from a first end point based oninitialization of a session for a user device associated withcommunications between the first end point and a second end point,wherein the first communication report includes a first hash thatcorresponds to a function of a randomization token and identityinformation; obtaining, by the controller, a second communication reportfrom the second end point based on the initialization of the session forthe user device, wherein the second communication report includes asecond hash that corresponds to a function of the randomization tokenand the identity information; determining whether the first hash matchesthe second hash; and generating a value that correlates the first endpoint and the second end point with the session for the user device inresponse to determining that the first hash matches the second hash. 2.The method of claim 1, further comprising: prior to obtaining the firstcommunication report from the first end point, transmitting a message tothe first end point that includes an instruction to initiate acommunication type when the first end point communicates with the secondend point.
 3. The method of claim 1, wherein the randomization token isgenerated by the first end point.
 4. The method of claim 1, furthercomprising: instructing the first end point to refresh the randomizationtoken for a new user device session.
 5. The method of claim 1, whereingenerating the value includes generating an entry in a sessioncorrelation matrix that correlates the first end point and the secondend point with the session for the user device.
 6. The method of claim1, wherein the first end point corresponds to an access provider.
 7. Themethod of claim 1, wherein the second end point corresponds to anidentity provider.
 8. The method of claim 1, wherein the identityinformation corresponds to at least one of a Media Access Control (MAC)address, an Internet Protocol (IP) address, and a location associatedwith the user device.
 9. The method of claim 1, wherein the firstcommunication report and the second communication report correspond to aFederated Ticker System (F-TICKs) report.
 10. A device comprising: oneor more processors; a non-transitory memory; and one or more programsstored in the non-transitory memory, which, when executed by the one ormore processors, cause the device to: obtain a first communicationreport from a first end point based on initialization of a session for auser device associated with communications between the first end pointand a second end point, wherein the first communication report includesa first hash that corresponds to a function of a randomization token andidentity information; obtain a second communication report from thesecond end point based on the initialization of the session for the userdevice, wherein the second communication report includes a second hashthat corresponds to a function of the randomization token and theidentity information; determine whether the first hash matches thesecond hash; and generate a value that correlates the first end pointand the second end point with the session for the user device inresponse to determining that the first hash matches the second hash. 11.The device of claim 10, wherein the one or more programs, when executedby the one or more processors, cause the device to: prior to obtainingthe first communication report from the first end point, transmit amessage to the first end point that includes an instruction to initiatea communication type when the first end point communicates with thesecond end point.
 12. The device of claim 10, wherein the one or moreprograms, when executed by the one or more processors, cause the deviceto: instruct the first end point to refresh the randomization token fora new user device session.
 13. The device of claim 10, wherein togenerate the value includes to generate an entry in a sessioncorrelation matrix that correlates the first end point and the secondend point with the session for the user device.
 14. The device of claim10, wherein the identity information corresponds to at least one of aMedia Access Control (MAC) address, an Internet Protocol (IP) address,and a location associated with the user device.
 15. A non-transitorymemory storing one or more programs, the one or more programs comprisinginstructions, which, when executed by one or more processors of adevice, cause the device to: obtain a first communication report from afirst end point based on initialization of a session for a user deviceassociated with communications between the first end point and a secondend point, wherein the first communication report includes a first hashthat corresponds to a function of a randomization token and identityinformation; obtain a second communication report from the second endpoint based on the initialization of the session for the user device,wherein the second communication report includes a second hash thatcorresponds to a function of the randomization token and the identityinformation; determine whether the first hash matches the second hash;and generate a value that correlates the first end point and the secondend point with the session for the user device in response todetermining that the first hash matches the second hash.
 16. Thenon-transitory memory of claim 15, wherein the one or more programsfurther comprise instructions, which, when executed by the one or moreprocessors of the device, cause the device to: prior to obtaining thefirst communication report from the first end point, transmit a messageto the first end point that includes an instruction to initiate acommunication type when the first end point communicates with the secondend point.
 17. The non-transitory memory of claim 15, wherein the one ormore programs further comprise instructions, which, when executed by theone or more processors of the device, cause the device to: instruct thefirst end point to refresh the randomization token for a new user devicesession.
 18. The non-transitory memory of claim 15, wherein to generatethe value includes to generate an entry in a session correlation matrixthat correlates the first end point and the second end point with thesession for the user device.
 19. The non-transitory memory of claim 15,wherein the identity information corresponds to at least one of a MediaAccess Control (MAC) address, an Internet Protocol (IP) address, and alocation associated with the user device.
 20. The non-transitory memoryof claim 15, wherein the first communication report and the secondcommunication report correspond to a Federated Ticker System (F-TICKs)report.